How to Locate the Host‑Side veth Peer of a Docker Container’s Network Interface

1. Overview

In a Docker container each network interface (NIC) may be part of a veth pair, with one end inside the container and the other in the host's network namespace. By default each container has its own network namespace, ensuring isolation, while the host‑side veth connects the container to external networks.

The host‑side veth serves as a communication bridge, provides network isolation, supplies IP configuration, and enables network policies and security controls.

2. Why Find the Host‑Side veth Peer?

Network troubleshooting: Determine whether connectivity issues originate inside the container or on the host.

Monitoring and management: Identify traffic belonging to a specific container for monitoring or applying policies.

Inter‑container communication: Facilitate custom networking between containers.

Configuration and optimization: Adjust bandwidth limits, change IP addresses, or fine‑tune network settings.

In short, locating the peer veth helps understand and control a container’s network connection.

3. Methods to Find the Host‑Side veth Peer

3.1 Method 1 – Read the iflink File Inside the Container

Enter the container and run:

# cd /sys/class/net/
# cat /sys/class/net/eth0/iflink

The output (e.g., 8) is the index of the host‑side veth. On the host, locate it with:

# ip link show | grep 8
8: veth13c5ce87@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> ...

3.2 Method 2 – Use ip link Inside the Container

Run ip link and note the pattern eth0@if8; the number after @ is the host veth index. Then on the host:

# ip link show | grep 8
8: veth13c5ce87@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> ...

3.3 Method 3 – Use ethtool Inside the Container

Execute:

# ethtool -S eth0
NIC statistics:
    peer_ifindex: 8

Again, search for index 8 on the host with ip link show | grep 8.

3.4 Method 4 – Enter the Container’s Network Namespace (Recommended)

Find the container ID (e.g., fa78537331d1) using docker ps.

Get the container’s network namespace PID:

# docker inspect --format "{{.State.Pid}}" fa78537331d1
16712

Enter the namespace and list interfaces:

# nsenter -n -t 16712
# ip link
1: lo: ...
3: eth0@if8: ...

On the host, locate the peer veth with the same index:

# ip link show | grep 8
8: veth13c5ce87@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> ...

4. Summary

The article presents four ways to discover the host‑side veth peer of a Docker container’s network interface, with the fourth method (entering the container’s network namespace) being strongly recommended.

Note: Both container IDs fa78537331d1 and 3ecfef7dbe7c refer to the same Pod and share the network namespace.